1. The Field of the Invention
The present invention relates to the field of electronic authentication. In particular, the present invention relates to methods and systems for authentication through multiple proxy servers that require different authentication data such as user identification and password.
2. Background and Related Art
A “proxy server” or “proxy” is a computer or computer system that acts as an intermediary between a client computer system (hereinafter, a “client”) and a server computer system (hereinafter, a “server”). When a client submits a request to a server, the proxy, through which the request must traverse, may require client authentication that is independent of the client authentication required by the server. One typical way for a client (or a user thereof) to authenticate to the proxy is to provide authentication data such as a user identification (ID) and password to the proxy. The client may also provide a separate user ID and password to the server when authenticating to the server.
The Internet standard HyperText Transport Protocol (HTTP) provides a transport level protocol for communicating between a client and server. Among other things, HTTP provides for a means for authentication to a proxy even though that proxy requires different authentication data than the server. Conventional HTTP allows for a header field that may include a user ID and password for authenticating to the proxy. HTTP also allows for a separate header that may include a separate user ID and password for authenticating to the server. Even if HTTP requests from the client traverse multiple proxies that require authentication on the way to the server, so long as the proxies each require the same user ID and password (as is often the case when the multiple proxies are managed by the same entity), the header that includes the password for the proxy may be used to authenticate to each proxy. Thus, conventional methods allow HTTP to be used to authenticate to a single proxy (or to multiple proxies that require the same user ID and password) and to a server.
These conventional methods have some advantages, including allowing for authentication to multiple proxies within a single administrative domain, all of which use the same credentials. However, these conventional methods do not allow for authentication through multiple proxies if those proxies require different authentication data as compared to each other.
Often, proxies that reside within a common sphere of trust may use the same user ID and password when authenticating a particular user. For example, proxies that are managed by the same entity may often use the same user ID and password to authenticate a particular user. However, it may be desirable to allow proxies between the client and server to user different authentication data when authenticating the user of the client. For example, suppose that the client is a wireless device and the server is a corporate server. The wireless device may communicate through a proxy managed by the wireless service as well as a proxy managed by the corporation that hosts the corporate server. The wireless service and the corporate server may not trust each other so far as to share a common user ID and password for a given user.
Therefore, what is desired are systems and methods for authentication through multiple proxies even though those multiple proxies may require different user IDs and passwords when authenticating. It would further be desirable if such authentication could be done so that each proxy may only access the authentication data relevant for authentication to that particular proxy, and not be able to access different authentication data intended for other proxies. It would also be desirable if such authentication could be done without modification of existing protocols and standards.